[sandiyochristan]

Summary

Remediates GHSA-4jj7-7g54-cqrv (CWE-306) by ensuring authentication is enabled by default when running Magg in HTTP or hybrid mode (magg serve --http / --hybrid).

Problem

Previously, when running magg serve --http without prior manual key configuration via magg auth, the server started with auth=None. In this state, unauthenticated network clients could invoke add_server with arbitrary commands, leading to remote code execution.

Solution

• When starting in --http or --hybrid mode without existing bearer keys:
  • Automatically generate an RSA keypair and emit a bearer admin access token (valid for 30 days) to console output.
  • Ensure parent directory creation for key_path if it does not already exist.
  • The generated keys are loaded into ServerManager's FastMCP auth provider, protecting all tool calls.
• Added --allow-unauthenticated flag for operators who explicitly want unauthenticated HTTP access, accompanied by a prominent security warning banner.
• Added regression tests covering CLI argument parsing, key generation behavior, and --allow-unauthenticated mode.

[sitbon]

Thanks, but this is documented behavior rather than a vulnerability. magg serve --http binds to localhost unless --host is set, and the docs cover what access to the server allows. Closing.